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What is Claimed is: 

1. A computer-readable medium having computer-executable 
instructions, comprising: 

performing ordinary error checking until a system crash of 
5 a particular type occurs; and 

after the system crash, power on self tests, and 
initiation of booting to an operating system, executing 
instructions and automatically performing enhanced error 
checking, the enhanced error checking performed depending on 
10 the particular type of system crash and operating to assist in 
locating instructions or software components that caused the 
system crash. 

2. The computer-readable medium of claim 1, further 
15 comprising: 

upon the system crash, storing a stop code that 
identifies the particular type of system crash; and 

after the power on self test and the initiation of booting 
to an operating system, retrieving the stop code and 
20 determining the enhanced error checking to perform based on the 
stop code. 



3. The computer-readable medium of claim 1, wherein the 
enhanced error checking is performed prior to a user diagnoses 
25 related to the system crash. 
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4. The computer-readable medium of claim 1, wherein the 
enhanced error checking is performed without a user diagnoses 
related to the system crash. 

5 

5. The computer-readable medium of claim 1, wherein the 
enhanced error checking comprises checking resource-related 
operations . 

10 6. The computer-readable medium of claim 5, wherein the 

resource-related operations comprise allocating and freeing 
memory. 

7. The computer-readable medium of claim 6, wherein 
15 checking resource-related operations comprises tracking each 

allocation and freeing of memory performed by at least one 
process . 

8. The computer-readable medium of claim 5, wherein the 
20 resource-related operations are performed by drivers that 

execute in kernel mode. 

9. The computer-readable medium of claim 5, wherein the 
resource-related operations comprise allocating and freeing 

25 page table entries. 
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10. The computer-readable medium of claim 1, wherein the 
enhanced error checking comprises checking for memory 
corruption. 

5 

11. The computer-readable medium of claim 10 , wherein the 
memory corruption occurs in memory reserved for kernel 
processes . 

10 12. The computer-readable medium of claim 11, wherein the 

memory corruption occurs by a kernel process writing to a block 
of memory after the kernel process has freed the block of 
memory. 

15 13. The computer-readable medium of claim 11, further 

comprising loading a driver verifier to monitor actions of one 
or more of the kernel processes. 

14. The computer-readable medium of claim 13, wherein the 
20 driver verifier provides a memory block to the one or more 

kernel processes , wherein the memory block is marked to remain 
in memory. 

15. The computer-readable medium of claim 14, wherein the 
25 memory block is aligned with the end of a page of memory having 
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a following page, wherein the following page is marked as 
inaccessible, such that an access to the following page results 
in an access violation. 

16. A computer-readable medium having computer-executable 
instructions , comprising : 

storing information associated with the system crash of a 
particular type, the information including a stop code that 
identifies the particular type of system crash; 

reading the stop code from the information; and 
automatically initiating a diagnostic procedure associated 
with the stop code, the diagnostic procedure designed to 
identify an instruction or software component that caused the 
system crash by collecting data tailored to identifying errors 
of the particular type that caused the system crash. 

17. The computer-readable medium of claim 16, wherein 
reading the stop code occurs after an operating system begins 
executing. 

18. The computer-readable medium of claim 17, further 
comprising changing the stop code before initiating the 
diagnostic procedure to select the diagnostic procedure. 
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19. A method for determining the cause of a system crash, 
comprising: 

identifying a type associated with the system crash; 
rebooting to an operating system after the system crash; 
5 automatically collecting information based on the type as 

the operating system executes; and 

providing the information upon demand. 



